@steedos/objectql 2.1.57 → 2.1.61

package/lib/types/object.js

@@ -16,6 +16,9 @@ var object_events_1 = require("./object_events");
 var i18n_1 = require("@steedos/i18n");
 var object_layouts_1 = require("./object_layouts");
 var lodash_1 = require("lodash");
+var shareRule_1 = require("./shareRule");
+var restrictionRule_1 = require("./restrictionRule");
+var field_permission_1 = require("./field_permission");
 var clone = require('clone');
 // 主子表有层级限制，超过3层就报错，该函数判断当前对象作为主表对象往下的层级最多不越过3层，
 // 其3层指的是A-B-C-D，它们都有父子关系，A作为最顶层，该对象上不可以再创建主表子表关系字段，但是B、C、D上可以；
@@ -713,117 +716,125 @@ var SteedosObjectType = /** @class */ (function (_super) {
     };
     SteedosObjectType.prototype.getUserObjectPermission = function (userSession) {
         return tslib_1.__awaiter(this, void 0, void 0, function () {
-            var roles, objectRolesPermission, userObjectPermission, field_permissions, spaceId;
+            var roles, objectRolesPermission, userObjectPermission, rolesFieldsPermission, field_permissions, spaceId;
             return tslib_1.__generator(this, function (_a) {
-                if (!userSession) {
-                    throw new Error('userSession is required');
-                }
-                roles = userSession.roles;
-                objectRolesPermission = this.getObjectRolesPermission(userSession.spaceId);
-                userObjectPermission = {
-                    allowRead: false,
-                    allowCreate: false,
-                    allowEdit: false,
-                    allowDelete: false,
-                    viewAllRecords: false,
-                    modifyAllRecords: false,
-                    viewCompanyRecords: false,
-                    modifyCompanyRecords: false,
-                    allowReadFiles: null,
-                    viewAllFiles: null,
-                    allowCreateFiles: null,
-                    allowEditFiles: null,
-                    allowDeleteFiles: null,
-                    modifyAllFiles: null,
-                    disabled_list_views: null,
-                    disabled_actions: null,
-                    unreadable_fields: null,
-                    uneditable_fields: null,
-                    unrelated_objects: null,
-                    field_permissions: null,
-                    read_filters: [],
-                    edit_filters: []
-                };
-                if (_.isEmpty(roles)) {
-                    throw new Error('not find user permission');
-                }
-                roles.forEach(function (role) {
-                    var rolePermission = objectRolesPermission[role];
-                    if (rolePermission) {
-                        _.each(userObjectPermission, function (v, k) {
-                            var _v = rolePermission[k];
-                            if (_.isBoolean(v)) {
-                                if (v === false && _v === true) {
-                                    userObjectPermission[k] = _v;
-                                }
-                            }
-                            else if (['allowReadFiles', 'viewAllFiles', 'allowCreateFiles', 'allowEditFiles', 'allowDeleteFiles', 'modifyAllFiles'].indexOf(k) > -1) {
-                                if (_.isBoolean(_v)) {
-                                    userObjectPermission[k] = _v;
-                                }
-                            }
-                            else if (['read_filters', 'edit_filters'].indexOf(k) > -1) {
-                                if ('edit_filters' === k) {
-                                    if (!_.isEmpty(_v)) {
-                                        userObjectPermission['read_filters'].push(_v);
+                switch (_a.label) {
+                    case 0:
+                        if (!userSession) {
+                            throw new Error('userSession is required');
+                        }
+                        roles = userSession.roles;
+                        objectRolesPermission = this.getObjectRolesPermission(userSession.spaceId);
+                        userObjectPermission = {
+                            allowRead: false,
+                            allowCreate: false,
+                            allowEdit: false,
+                            allowDelete: false,
+                            viewAllRecords: false,
+                            modifyAllRecords: false,
+                            viewCompanyRecords: false,
+                            modifyCompanyRecords: false,
+                            allowReadFiles: null,
+                            viewAllFiles: null,
+                            allowCreateFiles: null,
+                            allowEditFiles: null,
+                            allowDeleteFiles: null,
+                            modifyAllFiles: null,
+                            disabled_list_views: null,
+                            disabled_actions: null,
+                            unreadable_fields: null,
+                            uneditable_fields: null,
+                            unrelated_objects: null,
+                            field_permissions: null,
+                        };
+                        if (_.isEmpty(roles)) {
+                            throw new Error('not find user permission');
+                        }
+                        return [4 /*yield*/, field_permission_1.FieldPermission.getObjectFieldsPermissionGroupRole(this.name)];
+                    case 1:
+                        rolesFieldsPermission = _a.sent();
+                        roles.forEach(function (role) {
+                            var rolePermission = objectRolesPermission[role];
+                            if (rolePermission) {
+                                var roleFieldsPermission_1 = rolesFieldsPermission[role];
+                                _.each(userObjectPermission, function (v, k) {
+                                    var _v = rolePermission[k];
+                                    if (k === 'field_permissions') {
+                                        _v = roleFieldsPermission_1;
                                     }
-                                }
-                                if (!_.isEmpty(_v)) {
-                                    userObjectPermission[k].push(_v);
-                                }
+                                    if (_.isBoolean(v)) {
+                                        if (v === false && _v === true) {
+                                            userObjectPermission[k] = _v;
+                                        }
+                                    }
+                                    else if (['allowReadFiles', 'viewAllFiles', 'allowCreateFiles', 'allowEditFiles', 'allowDeleteFiles', 'modifyAllFiles'].indexOf(k) > -1) {
+                                        if (_.isBoolean(_v)) {
+                                            userObjectPermission[k] = _v;
+                                        }
+                                    }
+                                    else if (['read_filters', 'edit_filters'].indexOf(k) > -1) {
+                                        if ('edit_filters' === k) {
+                                            if (!_.isEmpty(_v)) {
+                                                userObjectPermission['read_filters'].push(_v);
+                                            }
+                                        }
+                                        if (!_.isEmpty(_v)) {
+                                            userObjectPermission[k].push(_v);
+                                        }
+                                    }
+                                    else if ((_.isArray(v) || _.isNull(v))) {
+                                        if (!_.isArray(_v)) {
+                                            _v = [];
+                                        }
+                                        if (_.isNull(v)) {
+                                            userObjectPermission[k] = _v;
+                                        }
+                                        else {
+                                            if (k === 'field_permissions') {
+                                                userObjectPermission[k] = _.union(v, _v);
+                                            }
+                                            else {
+                                                userObjectPermission[k] = _.intersection(v, _v);
+                                            }
+                                        }
+                                    }
+                                });
                             }
-                            else if ((_.isArray(v) || _.isNull(v))) {
-                                if (!_.isArray(_v)) {
-                                    _v = [];
-                                }
-                                if (_.isNull(v)) {
-                                    userObjectPermission[k] = _v;
-                                }
-                                else {
-                                    if (k === 'field_permissions') {
-                                        userObjectPermission[k] = _.union(v, _v);
+                        });
+                        field_permissions = {};
+                        if (userObjectPermission.field_permissions) {
+                            _.each(userObjectPermission.field_permissions, function (field_permission) {
+                                var field = field_permission.field, read = field_permission.read, edit = field_permission.edit;
+                                if (field_permissions[field]) {
+                                    field_permissions[field].edit = field_permissions[field].edit || edit;
+                                    if (field_permissions[field].edit) {
+                                        field_permissions[field].read = true;
                                     }
                                     else {
-                                        userObjectPermission[k] = _.intersection(v, _v);
+                                        field_permissions[field].read = field_permissions[field].read || read;
                                     }
                                 }
-                            }
-                        });
-                    }
-                });
-                field_permissions = {};
-                if (userObjectPermission.field_permissions) {
-                    _.each(userObjectPermission.field_permissions, function (field_permission) {
-                        var field = field_permission.field, read = field_permission.read, edit = field_permission.edit;
-                        if (field_permissions[field]) {
-                            field_permissions[field].edit = field_permissions[field].edit || edit;
-                            if (field_permissions[field].edit) {
-                                field_permissions[field].read = true;
-                            }
-                            else {
-                                field_permissions[field].read = field_permissions[field].read || read;
-                            }
+                                else {
+                                    field_permissions[field] = {
+                                        field: field,
+                                        read: edit || read,
+                                        edit: edit
+                                    };
+                                }
+                            });
                         }
-                        else {
-                            field_permissions[field] = {
-                                field: field,
-                                read: edit || read,
-                                edit: edit
-                            };
+                        userObjectPermission.field_permissions = field_permissions;
+                        userObjectPermission.disabled_list_views = userObjectPermission.disabled_list_views || [];
+                        userObjectPermission.disabled_actions = userObjectPermission.disabled_actions || [];
+                        userObjectPermission.unreadable_fields = userObjectPermission.unreadable_fields || [];
+                        userObjectPermission.uneditable_fields = userObjectPermission.uneditable_fields || [];
+                        userObjectPermission.unrelated_objects = userObjectPermission.unrelated_objects || [];
+                        spaceId = userSession.spaceId;
+                        if (util_1.isTemplateSpace(spaceId)) {
+                            return [2 /*return*/, Object.assign({}, userObjectPermission, { allowRead: true, viewAllRecords: true, viewCompanyRecords: true })];
                         }
-                    });
+                        return [2 /*return*/, userObjectPermission];
                 }
-                userObjectPermission.field_permissions = field_permissions;
-                userObjectPermission.disabled_list_views = userObjectPermission.disabled_list_views || [];
-                userObjectPermission.disabled_actions = userObjectPermission.disabled_actions || [];
-                userObjectPermission.unreadable_fields = userObjectPermission.unreadable_fields || [];
-                userObjectPermission.uneditable_fields = userObjectPermission.uneditable_fields || [];
-                userObjectPermission.unrelated_objects = userObjectPermission.unrelated_objects || [];
-                spaceId = userSession.spaceId;
-                if (util_1.isTemplateSpace(spaceId)) {
-                    return [2 /*return*/, Object.assign({}, userObjectPermission, { allowRead: true, viewAllRecords: true, viewCompanyRecords: true })];
-                }
-                return [2 /*return*/, userObjectPermission];
             });
         });
     };
@@ -1795,42 +1806,29 @@ var SteedosObjectType = /** @class */ (function (_super) {
             });
         });
     };
-    SteedosObjectType.prototype.appendRecordPermission = function (records, userSession) {
-        return tslib_1.__awaiter(this, void 0, void 0, function () {
-            var _ids, objPm, permissionFilters, filters, results, allowEditIds;
-            return tslib_1.__generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        _ids = _.pluck(records, '_id');
-                        return [4 /*yield*/, this.getUserObjectPermission(userSession)];
-                    case 1:
-                        objPm = _a.sent();
-                        permissionFilters = this.getObjectPermissionFilters(objPm, userSession, true);
-                        if (_.isEmpty(permissionFilters)) {
-                            return [2 /*return*/];
-                        }
-                        filters = filters_1.formatFiltersToODataQuery(['_id', 'in', _ids]);
-                        return [4 /*yield*/, this.directFind({
-                                fields: ['_id'],
-                                filters: "(" + filters + ") and (" + permissionFilters.join(' or ') + ")"
-                            })];
-                    case 2:
-                        results = _a.sent();
-                        allowEditIds = _.pluck(results, '_id');
-                        _.each(records, function (record) {
-                            if (_.include(allowEditIds, record._id)) {
-                                record.record_permissions = {
-                                    allowRead: true,
-                                    allowEdit: true,
-                                    allowDelete: true,
-                                };
-                            }
-                        });
-                        return [2 /*return*/];
-                }
-            });
-        });
-    };
+    // private async appendRecordPermission(records, userSession) {
+    //     const _ids = _.pluck(records, '_id');
+    //     const objPm = await this.getUserObjectPermission(userSession);
+    //     const permissionFilters = this.getObjectPermissionFilters(objPm, userSession, true);
+    //     if (_.isEmpty(permissionFilters)) {
+    //         return;
+    //     }
+    //     const filters = formatFiltersToODataQuery(['_id', 'in', _ids])
+    //     const results = await this.directFind({
+    //         fields: ['_id'],
+    //         filters: `(${filters}) and (${permissionFilters.join(' or ')})`
+    //     });
+    //     const allowEditIds = _.pluck(results, '_id');
+    //     _.each(records, (record) => {
+    //         if (_.include(allowEditIds, record._id)) {
+    //             record.record_permissions = {
+    //                 allowRead: true,
+    //                 allowEdit: true,
+    //                 allowDelete: true,
+    //             }
+    //         }
+    //     })
+    // }
     SteedosObjectType.prototype.getTriggerContext = function (when, method, args, recordId) {
         return tslib_1.__awaiter(this, void 0, void 0, function () {
             var userSession, context, _a;
@@ -1920,7 +1918,7 @@ var SteedosObjectType = /** @class */ (function (_super) {
             args[_i - 1] = arguments[_i];
         }
         return tslib_1.__awaiter(this, void 0, void 0, function () {
-            var adapterMethod, allow, objectName, recordId, doc, paramRecordId, returnValue, userSession, beforeTriggerContext, afterTriggerContext, previousDoc, values, _records;
+            var adapterMethod, allow, objectName, recordId, doc, paramRecordId, returnValue, userSession, beforeTriggerContext, afterTriggerContext, previousDoc, values;
             return tslib_1.__generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
@@ -1963,7 +1961,7 @@ var SteedosObjectType = /** @class */ (function (_super) {
                         return [4 /*yield*/, adapterMethod.apply(this._datasource, args)];
                     case 4:
                         returnValue = _a.sent();
-                        return [3 /*break*/, 25];
+                        return [3 /*break*/, 21];
                     case 5:
                         userSession = args[args.length - 1];
                         return [4 /*yield*/, this.getTriggerContext('before', method, args)];
@@ -1989,43 +1987,40 @@ var SteedosObjectType = /** @class */ (function (_super) {
                         return [4 /*yield*/, adapterMethod.apply(this._datasource, args)];
                     case 10:
                         returnValue = _a.sent();
-                        if (!(method === 'find' || method == 'findOne' || method == 'count' || method == 'aggregate' || method == 'aggregatePrefixalPipeline')) return [3 /*break*/, 14];
-                        values = returnValue || {};
-                        if (!(method === 'count')) return [3 /*break*/, 11];
-                        values = returnValue || 0;
-                        return [3 /*break*/, 13];
-                    case 11:
-                        if (!userSession) return [3 /*break*/, 13];
-                        _records = returnValue;
-                        if (method == 'findOne' && returnValue) {
-                            _records = [_records];
+                        if (method === 'find' || method == 'findOne' || method == 'count' || method == 'aggregate' || method == 'aggregatePrefixalPipeline') {
+                            values = returnValue || {};
+                            if (method === 'count') {
+                                values = returnValue || 0;
+                            }
+                            // else{
+                            //     if (userSession) {
+                            //         let _records = returnValue
+                            //         if (method == 'findOne' && returnValue) {
+                            //             _records = [_records]
+                            //         }
+                            //         await this.appendRecordPermission(_records, userSession);
+                            //     }
+                            // }
+                            Object.assign(afterTriggerContext, { data: { values: values } });
                         }
-                        return [4 /*yield*/, this.appendRecordPermission(_records, userSession)];
-                    case 12:
-                        _a.sent();
-                        _a.label = 13;
-                    case 13:
-                        Object.assign(afterTriggerContext, { data: { values: values } });
-                        _a.label = 14;
-                    case 14:
                         // console.log("==returnValue==", returnValue);
                         if (method == 'insert' && _.has(returnValue, '_id')) {
                             afterTriggerContext.doc = returnValue;
                             afterTriggerContext = Object.assign({}, afterTriggerContext, { id: returnValue._id });
                         }
-                        if (!(method == "update")) return [3 /*break*/, 17];
-                        if (!returnValue) return [3 /*break*/, 16];
+                        if (!(method == "update")) return [3 /*break*/, 13];
+                        if (!returnValue) return [3 /*break*/, 12];
                         afterTriggerContext.doc = returnValue;
                         return [4 /*yield*/, this.runAfterTriggers(method, afterTriggerContext)];
-                    case 15:
+                    case 11:
                         _a.sent();
-                        _a.label = 16;
-                    case 16: return [3 /*break*/, 19];
-                    case 17: return [4 /*yield*/, this.runAfterTriggers(method, afterTriggerContext)];
-                    case 18:
+                        _a.label = 12;
+                    case 12: return [3 /*break*/, 15];
+                    case 13: return [4 /*yield*/, this.runAfterTriggers(method, afterTriggerContext)];
+                    case 14:
                         _a.sent();
-                        _a.label = 19;
-                    case 19:
+                        _a.label = 15;
+                    case 15:
                         if (method === 'find' || method == 'findOne' || method == 'count' || method == 'aggregate' || method == 'aggregatePrefixalPipeline') {
                             if (_.isEmpty(afterTriggerContext.data) || (_.isEmpty(afterTriggerContext.data.values) && !_.isNumber(afterTriggerContext.data.values))) {
                                 return [2 /*return*/, returnValue];
@@ -2041,9 +2036,9 @@ var SteedosObjectType = /** @class */ (function (_super) {
                                 user_session: userSession,
                                 previous_record: afterTriggerContext.previousDoc
                             }).run()];
-                    case 20:
+                    case 16:
                         _a.sent();
-                        if (!returnValue) return [3 /*break*/, 23];
+                        if (!returnValue) return [3 /*break*/, 19];
                         if (method === "insert") {
                             // 当为insert时，上面代码执行后的doc不带_id，只能从returnValue中取
                             doc = returnValue;
@@ -2051,18 +2046,18 @@ var SteedosObjectType = /** @class */ (function (_super) {
                         }
                         // 一定要先运行公式再运行汇总，以下两个函数顺序不能反
                         return [4 /*yield*/, this.runRecordFormula(method, objectName, recordId, doc, userSession)];
-                    case 21:
+                    case 17:
                         // 一定要先运行公式再运行汇总，以下两个函数顺序不能反
                         _a.sent();
                         return [4 /*yield*/, this.runRecordSummaries(method, objectName, recordId, doc, previousDoc, userSession)];
-                    case 22:
+                    case 18:
                         _a.sent();
-                        _a.label = 23;
-                    case 23: return [4 /*yield*/, object_events_1.brokeEmitEvents(objectName, method, afterTriggerContext)];
-                    case 24:
+                        _a.label = 19;
+                    case 19: return [4 /*yield*/, object_events_1.brokeEmitEvents(objectName, method, afterTriggerContext)];
+                    case 20:
                         _a.sent();
-                        _a.label = 25;
-                    case 25: return [2 /*return*/, returnValue];
+                        _a.label = 21;
+                    case 21: return [2 /*return*/, returnValue];
                 }
             });
         });
@@ -2117,29 +2112,28 @@ var SteedosObjectType = /** @class */ (function (_super) {
             });
         });
     };
-    SteedosObjectType.prototype.getObjectPermissionFilters = function (objectPermission, userSession, isEdit) {
-        var objectPermissionFilters = [];
-        var permissionFiltersKey = 'read_filters';
-        if (isEdit) {
-            permissionFiltersKey = 'edit_filters';
-        }
-        var globalData = Object.assign({}, userSession, { now: new Date() });
-        var permissionFilters = objectPermission[permissionFiltersKey];
-        _.each(permissionFilters, function (permissionFilter) {
-            if (_.isString(permissionFilter) && util_1.isExpression(permissionFilter.trim())) {
-                try {
-                    var filters = util_1.parseSingleExpression(permissionFilter, {}, "#", globalData);
-                    if (filters && !_.isString(filters)) {
-                        objectPermissionFilters.push("(" + filters_1.formatFiltersToODataQuery(filters, userSession) + ")");
-                    }
-                }
-                catch (error) {
-                    console.error("getObjectPermissionFilters error", permissionFilter, error.message);
-                }
-            }
-        });
-        return objectPermissionFilters;
-    };
+    // private getObjectPermissionFilters(objectPermission, userSession, isEdit) {
+    //     const objectPermissionFilters = [];
+    //     let permissionFiltersKey = 'read_filters';
+    //     if (isEdit) {
+    //         permissionFiltersKey = 'edit_filters';
+    //     }
+    //     const globalData = Object.assign({}, userSession, { now: new Date() });
+    //     let permissionFilters = objectPermission[permissionFiltersKey];
+    //     _.each(permissionFilters, (permissionFilter) => {
+    //         if (_.isString(permissionFilter) && isExpression(permissionFilter.trim())) {
+    //             try {
+    //                 const filters = parseSingleExpression(permissionFilter, {}, "#", globalData);
+    //                 if (filters && !_.isString(filters)) {
+    //                     objectPermissionFilters.push(`(${formatFiltersToODataQuery(filters, userSession)})`)
+    //                 }
+    //             } catch (error) {
+    //                 console.error(`getObjectPermissionFilters error`, permissionFilter, error.message);
+    //             }
+    //         }
+    //     })
+    //     return objectPermissionFilters;
+    // }
     /**
      * 把query.filters用formatFiltersToODataQuery转为odata query
      * 主要是为了把userSession中的utcOffset逻辑传入formatFiltersToODataQuery函数处理
@@ -2160,82 +2154,95 @@ var SteedosObjectType = /** @class */ (function (_super) {
     };
     SteedosObjectType.prototype.dealWithMethodPermission = function (method, args) {
         return tslib_1.__awaiter(this, void 0, void 0, function () {
-            var userSession, spaceId, userId, objPm, query, spaceFilter, companyFilter, ownerFilter, sharesFilter, objectPermissionFilters, clientFilter, filters, permissionFilters, userFilters, permissionFilters, objectPermissionEditFilters, id, companyFilters, queryFilters, companyFilters, permissionFilters, objectPermissionEditFilters, id, companyFilters;
+            var userSession, spaceId, userId, objPm, query, spaceFilter, companyFilter, ownerFilter, sharesFilter, shareRuleFilters, restrictionRuleFilters, clientFilter, filters, permissionFilters, userFilters, permissionFilters, objectPermissionEditFilters, id, companyFilters, queryFilters, companyFilters, permissionFilters, objectPermissionEditFilters, id, companyFilters;
             return tslib_1.__generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
                         userSession = args[args.length - 1];
-                        if (!userSession) return [3 /*break*/, 2];
+                        if (!userSession) return [3 /*break*/, 5];
                         spaceId = userSession.spaceId;
                         userId = userSession.userId;
                         return [4 /*yield*/, this.getUserObjectPermission(userSession)];
                     case 1:
                         objPm = _a.sent();
-                        if (method === 'find' || method === 'count' || method === 'findOne' || method === 'aggregate' || method === 'aggregatePrefixalPipeline') {
-                            query = args[args.length - 2];
-                            if (method === 'aggregate' || method === 'aggregatePrefixalPipeline') {
-                                query = args[args.length - 3];
-                            }
-                            if (query.filters && !_.isString(query.filters)) {
-                                query.filters = filters_1.formatFiltersToODataQuery(query.filters);
-                            }
-                            if (this.table_name == 'cfs.files.filerecord' || this.table_name == 'cfs.instances.filerecord') {
-                                return [2 /*return*/];
-                            }
-                            if (util_1.isCloudAdminSpace(spaceId)) {
-                                return [2 /*return*/];
-                            }
-                            spaceFilter = void 0, companyFilter = void 0, ownerFilter = void 0, sharesFilter = void 0, objectPermissionFilters = void 0, clientFilter = query.filters, filters = void 0, permissionFilters = [], userFilters = [];
-                            if (spaceId) {
-                                spaceFilter = "(space eq '" + spaceId + "')";
-                            }
-                            if (spaceId && !objPm.viewAllRecords && objPm.viewCompanyRecords) { // 公司级
-                                if (_.isEmpty(userSession.companies)) {
-                                    console.log('objPm', objPm);
-                                    throw new Error("user not belong any company!");
-                                }
-                                companyFilter = _.map(userSession.companies, function (comp) {
-                                    return "(company_id eq '" + comp._id + "') or (company_ids eq '" + comp._id + "')";
-                                });
-                            }
-                            if (!objPm.viewAllRecords && !objPm.viewCompanyRecords && objPm.allowRead) { // owner
-                                ownerFilter = "(owner eq '" + userId + "')";
-                            }
-                            objectPermissionFilters = this.getObjectPermissionFilters(objPm, userSession, false);
-                            if (!_.isEmpty(objectPermissionFilters)) {
-                                permissionFilters.push("(" + objectPermissionFilters.join(' or ') + ")");
-                            }
-                            sharesFilter = util_1.getUserObjectSharesFilters(this.name, userSession);
-                            if (!_.isEmpty(companyFilter)) {
-                                permissionFilters.push("(" + companyFilter.join(' or ') + ")");
-                            }
-                            if (ownerFilter) {
-                                permissionFilters.push(ownerFilter);
-                            }
-                            if (!_.isEmpty(sharesFilter)) {
-                                permissionFilters.push("(" + sharesFilter.join(' or ') + ")");
-                            }
-                            if (clientFilter) {
-                                userFilters.push(clientFilter);
-                            }
-                            if (spaceFilter) {
-                                userFilters.push(spaceFilter);
-                            }
-                            if (!userSession.is_space_admin && !_.isEmpty(permissionFilters)) {
-                                filters = permissionFilters.join(' or ');
-                            }
-                            if (!_.isEmpty(userFilters)) {
-                                filters = filters ? "(" + filters + ") and (" + userFilters.join(' and ') + ")" : userFilters.join(' and ');
+                        if (!(method === 'find' || method === 'count' || method === 'findOne' || method === 'aggregate' || method === 'aggregatePrefixalPipeline')) return [3 /*break*/, 4];
+                        query = args[args.length - 2];
+                        if (method === 'aggregate' || method === 'aggregatePrefixalPipeline') {
+                            query = args[args.length - 3];
+                        }
+                        if (query.filters && !_.isString(query.filters)) {
+                            query.filters = filters_1.formatFiltersToODataQuery(query.filters);
+                        }
+                        if (this.table_name == 'cfs.files.filerecord' || this.table_name == 'cfs.instances.filerecord') {
+                            return [2 /*return*/];
+                        }
+                        if (util_1.isCloudAdminSpace(spaceId)) {
+                            return [2 /*return*/];
+                        }
+                        spaceFilter = void 0, companyFilter = void 0, ownerFilter = void 0, sharesFilter = void 0, shareRuleFilters = void 0, restrictionRuleFilters = void 0, clientFilter = query.filters, filters = void 0, permissionFilters = [], userFilters = [];
+                        if (spaceId) {
+                            spaceFilter = "(space eq '" + spaceId + "')";
+                        }
+                        if (spaceId && !objPm.viewAllRecords && objPm.viewCompanyRecords) { // 公司级
+                            if (_.isEmpty(userSession.companies)) {
+                                console.log('objPm', objPm);
+                                throw new Error("user not belong any company!");
                             }
-                            query.filters = filters;
+                            companyFilter = _.map(userSession.companies, function (comp) {
+                                return "(company_id eq '" + comp._id + "') or (company_ids eq '" + comp._id + "')";
+                            });
                         }
-                        else if (method === 'insert') {
+                        if (!objPm.viewAllRecords && !objPm.viewCompanyRecords && objPm.allowRead) { // owner
+                            ownerFilter = "(owner eq '" + userId + "')";
+                        }
+                        return [4 /*yield*/, shareRule_1.ShareRules.getUserObjectFilters(this.name, userSession)];
+                    case 2:
+                        shareRuleFilters = _a.sent();
+                        if (!_.isEmpty(shareRuleFilters)) {
+                            permissionFilters.push("(" + shareRuleFilters.join(' or ') + ")");
+                        }
+                        return [4 /*yield*/, restrictionRule_1.RestrictionRule.getUserObjectFilters(this.name, userSession)];
+                    case 3:
+                        restrictionRuleFilters = _a.sent();
+                        if (!_.isEmpty(restrictionRuleFilters)) {
+                            userFilters.push("(" + restrictionRuleFilters.join(' or ') + ")");
+                        }
+                        // objectPermissionFilters = this.getObjectPermissionFilters(objPm, userSession, false);
+                        // if (!_.isEmpty(objectPermissionFilters)) {
+                        //     permissionFilters.push(`(${objectPermissionFilters.join(' or ')})`);
+                        // }
+                        sharesFilter = util_1.getUserObjectSharesFilters(this.name, userSession);
+                        if (!_.isEmpty(companyFilter)) {
+                            permissionFilters.push("(" + companyFilter.join(' and ') + ")");
+                        }
+                        if (ownerFilter) {
+                            permissionFilters.push(ownerFilter);
+                        }
+                        if (!_.isEmpty(sharesFilter)) {
+                            permissionFilters.push("(" + sharesFilter.join(' or ') + ")");
+                        }
+                        if (clientFilter) {
+                            userFilters.push(clientFilter);
+                        }
+                        if (spaceFilter) {
+                            userFilters.push(spaceFilter);
+                        }
+                        if (!userSession.is_space_admin && !_.isEmpty(permissionFilters)) {
+                            filters = permissionFilters.join(' or ');
+                        }
+                        if (!_.isEmpty(userFilters)) {
+                            filters = filters ? "(" + filters + ") and (" + userFilters.join(' and ') + ")" : userFilters.join(' and ');
+                        }
+                        query.filters = filters;
+                        return [3 /*break*/, 5];
+                    case 4:
+                        if (method === 'insert') {
                             if (!objPm.allowCreate) {
                                 throw new Error("no " + method + " permission!");
                             }
                         }
                         else if (method === 'update' || method === 'updateOne') {
-                            permissionFilters = this.getObjectPermissionFilters(objPm, userSession, true);
+                            permissionFilters = null;
                             if (!objPm.allowEdit && _.isEmpty(permissionFilters)) {
                                 throw new Error("no " + method + " permission!");
                             }
@@ -2303,7 +2310,7 @@ var SteedosObjectType = /** @class */ (function (_super) {
                             }
                         }
                         else if (method === 'delete') {
-                            permissionFilters = this.getObjectPermissionFilters(objPm, userSession, true);
+                            permissionFilters = null;
                             if (!objPm.allowDelete && _.isEmpty(permissionFilters)) {
                                 throw new Error("no " + method + " permission!");
                             }
@@ -2336,8 +2343,8 @@ var SteedosObjectType = /** @class */ (function (_super) {
                             }
                             args[args.length - 2] = id;
                         }
-                        _a.label = 2;
-                    case 2: return [2 /*return*/];
+                        _a.label = 5;
+                    case 5: return [2 /*return*/];
                 }
             });
         });